Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
symfony/security-bundle
8.2 @ 56ea77e
8
Fixes
61
CVEs
CRITICAL
Peak severity
62.5%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
Security.php: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Signature verification could be bypassed if JWK keys not intended for signatures are accepted or if verification flags are not properly propagated to the OidcTokenHandler constructor. Developers must ensure enforce_key_usage_verification is consistently bound during token handler discovery initialization.
Auth Bypass: Manual user logins could bypass crucial security policies if they route directly to generic checkers instead of executing firewall-specific checks (e.g., checkPreAuth), potentially allowing disabled or locked accounts to authenticate.
Auth Bypass: Cross-firewall authentications may fail to persist newly minted tokens within the target firewall's active session key, leading to unexpected session states, state leakages, or security mechanism failures during transition.